https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230643#M1117877 <P>Hi,</P><P>A rule I created to filter RDP outbound using the predefined Application/RDP fails to function as if the protocol is not recognized, but if I change the same rule to not use Application/RDP and instead use a port object TCP/3389, it works fine.</P><P>After converting from ASA to FTD, I would like to start migrating rules from 4-tuples to Application rules, but this hardly inspires confidence. Is this a known issue or what could be the problem?</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 29 Nov 2024 17:29:07 GMT lcaruso 2024-11-29T17:29:07Z https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230643#M1117877 <P>Hi,</P><P>A rule I created to filter RDP outbound using the predefined Application/RDP fails to function as if the protocol is not recognized, but if I change the same rule to not use Application/RDP and instead use a port object TCP/3389, it works fine.</P><P>After converting from ASA to FTD, I would like to start migrating rules from 4-tuples to Application rules, but this hardly inspires confidence. Is this a known issue or what could be the problem?</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 29 Nov 2024 17:29:07 GMT https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230643#M1117877 lcaruso 2024-11-29T17:29:07Z https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230645#M1117878 <P>I will send you PM check it</P> <P>MHM</P> Fri, 29 Nov 2024 17:35:32 GMT https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230645#M1117878 MHM Cisco World 2024-11-29T17:35:32Z https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230651#M1117881 <P>If you have a sample pcap to share it would be good to see what could be the issue.</P> Fri, 29 Nov 2024 17:46:53 GMT https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230651#M1117881 ckleopa 2024-11-29T17:46:53Z https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230674#M1117884 <P>It's also possible that FTD is recognizing RDP under something different (low chance, but still possible!)&nbsp; If you check the Event log at either <EM><STRONG>Analysis &gt; Unified Events</STRONG></EM> or <EM><STRONG>Analysis &gt; Connection &gt; Events</STRONG></EM>, you can filter for the relevant traffic.&nbsp; The "Application Protocol" column in the output will display how FTD is categorizing the traffic.</P> Fri, 29 Nov 2024 19:09:22 GMT https://community.cisco.com/t5/network-security/ftd-7-4-2-1-and-rdp-application-rule/m-p/5230674#M1117884 Wrecktangle 2024-11-29T19:09:22Z